# Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets

- Severity: Critical · Status: Still active (live)
- Chains: Multiple EVM chains · Method: Social engineering and fake support
- Started: Sep 18, 2026 · Last update: Oct 22, 2026 · Reported stolen: $11M · Victims: 7000
- Who/what: Crypto, AI and NFT developers and job seekers
- AI involvement: AI-made lures. The attackers reportedly use AI face-swapping software during online job interviews, then turn off their cameras and blame network problems.

On 18 September 2026 Japanese, US, Australian and German authorities warned that the North Korean group WaterPlum, linked to the 'Contagious Interview' campaign, infected at least 30,000 devices in more than 100 countries between December 2025 and July 2026. Posing as AI, crypto or NFT firms and recruiters, they get targets to run code during fake interviews and coding tests, including malicious npm packages and VS Code projects, then steal private keys, seed phrases and passwords. Funds or credentials were taken from over 7,000 wallets, and more than 1.7 billion yen (about $10.71M) went to North Korea. The advisory does not say the campaign has stopped.

## Am I affected?
If in the past year you did a job interview, coding test or 'technical assessment' for a crypto, AI or NFT company and ran a repo, npm package or VS Code project they gave you, or ran a command to fix a video-call problem, treat that computer as compromised.

## What to do now
- From a different, clean device, create new wallets and move your funds. Assume every seed, private key and browser-saved password on the infected machine is stolen.
- Reinstall the operating system on the infected machine, then change passwords and rotate API keys, SSH keys and 2FA.

## How to avoid this
- Run interview code only in a throwaway virtual machine or cloud sandbox with no wallets or logins on it.
- Don't mark unknown folders as trusted in VS Code; read package.json scripts and .vscode/tasks.json first.
- Never paste a command from a recruiter or 'support' to fix your camera or microphone.

## Sources
- North Korean WaterPlum hackers infected 30,000 devices worldwide (BleepingComputer, 2026-09-19): https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/

Full record: https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026 · JSON: https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.